Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a50d25f4 authored by Shiv Maliyappanahalli's avatar Shiv Maliyappanahalli
Browse files

ASoC: codecs: fix out of bounds copy 



EDID data size could be greater than the mixer ctl can hold.
Return error if EDID data size is greater than what mixer ctl
can hold.

Change-Id: I06c8c8f82bbc0abd92ec7947ccdf48ce07e4fb47
Signed-off-by: default avatarShiv Maliyappanahalli <smaliyap@codeaurora.org>
parent ebc5196e

sound/soc/codecs/msm_hdmi_codec_rx.c

+10 −1
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -85,6 +85,15 @@ static int msm_ext_disp_edid_get(struct snd_kcontrol *kcontrol, 
	rc = codec_data->ext_disp_ops.get_audio_edid_blk(

			codec_data->ext_disp_core_pdev, &edid_blk);

	if (!IS_ERR_VALUE(rc)) {

		if (sizeof(ucontrol->value.bytes.data) <

			  (edid_blk.audio_data_blk_size +

			   edid_blk.spk_alloc_data_blk_size)) {

			dev_err(codec->dev,

				"%s: Not enough memory to copy EDID data\n",

				__func__);

			return -ENOMEM;

		}



		memcpy(ucontrol->value.bytes.data,

		       edid_blk.audio_data_blk,

		       edid_blk.audio_data_blk_size);